Loading threat actor…
Armored Likho is a previously documented threat cluster also associated with the name Eagle Werewolf and assessed to conduct both cyber-espionage operations against organizations and financially motivated intrusions against individuals. Activity attributed to the group has focused heavily on Russia, with additional confirmed victimology in Kazakhstan and Brazil. Reported targets include government agencies, electric power organizations, major enterprises, IT companies, educational institutions, and private individuals. The actor relies primarily on spear-phishing and social-engineering lures themed as official notices, social programs, humanitarian aid, psychological tests, and charitable assistance. Observed delivery chains have used malicious archives, executable droppers, and Windows shortcut files, including abuse of CVE-2025-9491, followed by obfuscated PowerShell and staged payload retrieval. Attribution to Armored Likho has been supported by recurring overlaps in malware architecture, persistence patterns, command-and-control design, encryption methods, host-identification logic, and tunneling functionality across campaigns. A major malware family associated with the group is BusySnake Stealer, a Python-based and heavily obfuscated infostealer used against government and electric power targets. BusySnake supports credential theft from Chromium-based browsers and Firefox, cookie theft, clipboard monitoring, screenshot capture, document collection, Telegram data theft, cryptocurrency- and OTP-related data theft, persistence via scheduled tasks, remote task execution, and reverse SSH tunneling for sustained operator access. Newer BusySnake variants added stealthier persistence creation, delayed execution, task-state tracking, and in-memory execution of arbitrary Python scripts. The group has also used Go2Tunnel for reverse SSH tunneling and has shown architectural similarities to AquilaRAT. In a separate 2026 espionage campaign, Armored Likho deployed the Rust-based Still Toolkit through a fake donation-themed application. Still Toolkit includes Still Sync, which steals and abuses authenticated Telegram Desktop session data to collect chats, contacts, groups, channels, and media, and Still Audio, which performs covert microphone surveillance and uploads recorded speech. These capabilities indicate an emphasis on long-term intelligence collection, session hijacking, and covert monitoring in addition to conventional credential and document theft. Overall, Armored Likho is characterized by phishing-led initial access, modular malware development, persistence, data theft, covert surveillance, and post-compromise remote access. The actor’s operations show a blend of espionage tradecraft and financially motivated theft, with repeated targeting of public-sector and critical infrastructure entities, especially in the electric power sector.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
47 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
89 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a cyber-espionage campaign using a fake donation application to infect targets in Russia with the Rust-based Still Toolkit, enabling Telegram session theft, chat and file collection, and microphone surveillance.
Conducting a cyber-espionage campaign in Russia using fake donation-themed apps as droppers and a Rust-based toolkit to steal Telegram session data, collect chats/media, and perform covert audio surveillance.
Cyber-espionage campaign targeting private users and organizations in Russia using fake charity-themed applications as droppers and a new Rust-based Still Toolkit for Telegram session theft, Telegram data collection, and covert audio surveillance.
Conducting a cyber-espionage campaign in Russia using fake donation-themed apps as droppers and a Rust-based toolkit ('Still Toolkit') for Telegram data theft and covert audio surveillance.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.